Study ANS-C01 hybrid routing for Direct Connect, Site-to-Site VPN, Transit Gateway, Direct Connect Gateway, BGP, failover, and route control.
Hybrid routing questions on ANS-C01 are not just “Direct Connect versus VPN” questions. They test whether you can design the path between on-premises networks and AWS, control which prefixes are advertised, preserve failover behavior, and choose the right attachment model for one VPC, many VPCs, many accounts, or a global network.
The current AWS task statement is to design a routing strategy and connectivity architecture between on-premises networks and the AWS Cloud. The official scope calls out routing fundamentals, dynamic versus static routing, BGP, redundant hybrid connectivity, Direct Connect, Site-to-Site VPN, and patterns for private connectivity. Treat every hybrid stem as a route-control problem first and a service-selection problem second.
| Design question | Why it matters |
|---|---|
| Is the path private, encrypted over the internet, or both? | Direct Connect and VPN solve different transport and encryption requirements. |
| Is the design for one VPC or many VPCs? | Virtual private gateway, Transit Gateway, Direct Connect Gateway, and Cloud WAN patterns differ. |
| Are routes static or dynamic? | Static routes are simpler but weaker for scalable failover; BGP gives route exchange and liveness behavior. |
| What prefixes are advertised? | Bad prefix design causes black holes, route leaks, asymmetric routing, or unintended access. |
| How does failover occur? | Redundancy is not useful unless the route-control behavior is predictable. |
| Where is the return path? | Hybrid answers often fail because they design only the forward path. |
Strong answers describe the connection, the routing protocol, the route table behavior, and the failure path.
| Requirement | Strongest first fit | Why |
|---|---|---|
| Faster setup, encrypted tunnels over the internet, or backup connectivity | AWS Site-to-Site VPN | IPsec VPN is faster to establish and useful as primary for modest needs or backup for Direct Connect. |
| Predictable private connectivity, consistent throughput, or enterprise WAN integration | AWS Direct Connect | Dedicated private connectivity is stronger for steady, business-critical hybrid traffic. |
| One VPC needs direct private connectivity to on-premises | Direct Connect or VPN to a virtual private gateway | VGW can be enough when the design is intentionally VPC-scoped. |
| Many VPCs need centralized hybrid routing | Transit Gateway with VPN or Direct Connect Gateway integration | TGW centralizes attachments and route tables. |
| Direct Connect should reach multiple VPCs or Regions | Direct Connect Gateway | DXGW connects Direct Connect to virtual private gateways, Transit Gateway, or Cloud WAN patterns. |
| Global network policy across Regions and sites is the center of the question | AWS Cloud WAN with appropriate hybrid attachments | Cloud WAN is stronger when global segmentation and policy are the point. |
| Private access to one producer service, not full network routing | PrivateLink | PrivateLink avoids broad hybrid/VPC routing when only one service must be exposed. |
Use this model before choosing an answer. It separates transport from routing from segmentation.
flowchart LR
O["On-premises network"] --> C["Customer gateway / router"]
C --> X["VPN or Direct Connect"]
X --> A["AWS attachment: VGW, TGW, DXGW, or Cloud WAN"]
A --> R["Route tables, propagated routes, and allowed prefixes"]
R --> V["VPC, subnet, endpoint, or service"]
Most wrong answers skip one of these boxes. The service may be right, but the route advertisement, attachment type, or return path may be wrong.
| Exam clue | Direct Connect is stronger when… | Site-to-Site VPN is stronger when… |
|---|---|---|
| Transport | Dedicated private connectivity is required. | Internet transport is acceptable or preferred for speed of setup. |
| Performance | Predictable bandwidth and latency are central. | Modest bandwidth or backup connectivity is enough. |
| Encryption | Private transport is required, and encryption must be added separately if needed. | IPsec encryption over the internet is explicitly required. |
| Timeline | Provisioning time and provider coordination are acceptable. | Rapid deployment is more important. |
| Resilience | Multiple locations, links, and BGP route policy can be designed. | Redundant tunnels or multiple VPN connections satisfy the availability target. |
| Common role | Primary enterprise hybrid path. | Initial, backup, encrypted, or smaller-scale hybrid path. |
Do not assume Direct Connect is always the answer because the exam is advanced. If the stem emphasizes encrypted internet transport, quick setup, or backup, VPN may be the stronger first fit. If it emphasizes predictable private enterprise connectivity, Direct Connect is usually stronger.
AWS Site-to-Site VPN supports static and dynamic routing patterns. When the customer gateway supports BGP, AWS documentation recommends dynamic routing because BGP provides route exchange and liveness behavior that can help fail over between tunnels.
| Requirement | Static routing | Dynamic routing with BGP |
|---|---|---|
| Small fixed prefix set | Can work | Also works, but may be more than required |
| Customer gateway cannot run BGP | Required fallback | Not available |
| Need route exchange and liveness-based failover | Weak | Stronger |
| Need scalable prefix management | Weak | Stronger |
| Need route preference engineering | Limited | Stronger with BGP attributes and route policy |
ANS-C01 frequently hides BGP inside failover and route-control language. If the question says “advertise,” “propagate,” “prefer,” “fail over,” “asymmetric,” or “multiple paths,” think carefully about BGP behavior.
| Pattern | Use when | Watch for |
|---|---|---|
| VPN to virtual private gateway | One VPC needs encrypted hybrid access | VPC-scoped design, route propagation, and tunnel failover. |
| Direct Connect private VIF to virtual private gateway | One or a small set of VPC-focused private paths | VGW association and prefix control. |
| Direct Connect transit VIF through Direct Connect Gateway to Transit Gateway | Many VPCs or accounts need centralized hybrid routing | TGW route tables, attachment propagation, allowed prefixes, and segmentation. |
| VPN to Transit Gateway | Many VPCs need VPN-based hybrid access | TGW route tables and VPN/BGP behavior. |
| Direct Connect plus VPN backup | Private primary path with encrypted internet backup | Route preference, failover timing, and return path symmetry. |
| Cloud WAN with Direct Connect Gateway | Global core network policy and segmentation matter | Core network policy, segments, attachments, and routing intent. |
The exam rewards choosing the smallest architecture that satisfies scale and failure requirements. Do not introduce Transit Gateway or Cloud WAN if the scenario is clearly one VPC. Do not use a single VGW pattern when the scenario is many VPCs across accounts.
A redundant hybrid design needs path diversity and route behavior. A second connection in the same fragile path may not satisfy the requirement.
| Resilience requirement | Strong design cue |
|---|---|
| Avoid single device failure | Redundant customer gateway devices or routers. |
| Avoid single AWS connection failure | Multiple VPN tunnels or Direct Connect connections. |
| Avoid single facility failure | Connections in separate Direct Connect locations when high resilience is required. |
| Avoid Region or attachment concentration | Multi-Region or multi-attachment strategy when the business requirement demands it. |
| Make failover predictable | BGP, route priority, health checks, and tested failover procedures. |
| Prove resilience | CloudWatch metrics, Network Manager, route tables, and failover tests. |
Maximum-resilience Direct Connect designs use diverse connections and locations. For exam reasoning, remember that redundancy must match the failure domain described in the stem.
| Trap | Better instinct |
|---|---|
| Only designing the forward path | Verify the return route, propagated routes, and security controls. |
| Advertising broad prefixes by default | Advertise only required prefixes and avoid route leaks. |
| Treating BGP as magic failover | Decide route preference, local preference, AS path behavior, and tunnel priorities where relevant. |
| Ignoring overlapping CIDRs | Resolve overlap before designing routing; routing cannot fix ambiguous address space. |
| Using full VPC routing for one private service | Consider PrivateLink when the requirement is narrow producer-consumer access. |
| Mixing production and nonproduction without route segmentation | Use TGW route tables, Cloud WAN segments, or separate attachments where isolation matters. |
Hybrid questions often look like connectivity questions but are really segmentation or prefix-control questions.
| Scenario | Strong first design |
|---|---|
| Enterprise data center needs predictable private access to many AWS VPCs | Direct Connect with DXGW and Transit Gateway, plus route-table segmentation. |
| Branch offices need encrypted connectivity quickly | Site-to-Site VPN, often with dynamic routing if supported. |
| Direct Connect is primary but must fail over to encrypted internet transport | Direct Connect plus VPN backup with explicit route preference. |
| Only one internal service should be consumed from on-premises or another VPC | PrivateLink if broad routing is not required. |
| Many accounts need isolated production and nonproduction hybrid routes | Transit Gateway route tables or Cloud WAN segments, not one flat propagated route domain. |
| A route change broke hybrid connectivity | Check BGP advertisements, propagated routes, route priorities, return path, and security controls. |
| Stem clue | Eliminate first | Keep in play |
|---|---|---|
| predictable private connectivity | internet VPN as the only enterprise answer | Direct Connect, often with VPN backup |
| encrypted internet transport | Direct Connect alone | Site-to-Site VPN |
| many VPCs and accounts | one VGW per VPC as the only scale pattern | Transit Gateway, DXGW, Cloud WAN where appropriate |
| one private service only | broad routing by reflex | PrivateLink |
| failover between tunnels | static routes without health or route-control behavior | BGP-capable VPN when available |
| overlapping CIDRs | more route propagation | address redesign, NAT pattern, or service-level exposure |
| hybrid outage after route update | security group change only | BGP, route tables, propagated routes, prefix filters, and return path |
When a hybrid scenario breaks, use this order:
This order is more reliable than opening security groups first and hoping the route problem disappears.
A company has two data centers and dozens of VPCs across multiple AWS accounts. The company needs predictable private connectivity from the data centers to AWS and wants to segment production and nonproduction routes. The network team also wants dynamic route exchange and tested failover. Which design is strongest?
Answer: Use redundant Direct Connect with DXGW, Transit Gateway, and segmented TGW route tables.
Why: The scenario emphasizes predictable private connectivity, many VPCs/accounts, dynamic routing, route segmentation, and failover. A single static VPN to one VPC does not satisfy scale or resilience. Public subnets violate the private-connectivity goal. CloudFront is an HTTP edge service, not a hybrid routing architecture.
Choose Site-to-Site VPN for encrypted internet transport, fast setup, or backup. Choose Direct Connect for predictable private enterprise connectivity. Add Transit Gateway when many VPCs or accounts need centralized routing. Add Direct Connect Gateway when Direct Connect must connect into VGW, TGW, or Cloud WAN patterns. Prefer BGP when dynamic route exchange and failover behavior matter. Use PrivateLink when the requirement is narrow private service access rather than broad network routing.
Continue with 1.6 Multi-VPC and Multi-Region Connectivity to apply the same route-control model across accounts, VPCs, and Regions.